NAT ACL counters not incrementing ISR 4331

[Jasson]

Earlier on 15.0 and 15.1 versions of IOS. When I apply ACL to NAT, counters is incrementing , but on ISR 4331 with IOS 15.5 does not work. If I apply the ACL to the interface, the counter is incrementing, the counter does not increase only with ACLs that are related to NAT

I tried two versions of iOS

15.5(3)s4b

15.5(3)s6

The result is the same

Using the command: show ip access-lists [list name]

Configuration:

[Georg Pauwen]

Hello, 

looking at your screen, and just to be sure it is there, because I do not see it in your configuration: the default route, do you have that configured ?

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0

[Jasson]

Yes, default route is configured:

ip route 0.0.0.0 0.0.0.0 217.20.17.2

[Georg Pauwen]

Hello,

as far as I recall, on the 4000 ISR routers, packet processing now occurs in hardware, so the counters are not incremented.

Try using 'no ip route-cache cef' on the NAT enabled interfaces to see the flows and the counters increase in your access list.

[JassonAXE]

I tried to apply the command that you wrote

[Georg Pauwen]

Hello,

try and disable cef globally:

Router(config)#no ip cef

[JassonAXE]

4331 - Router

2921 - Router

Honestly, I'm a bit confused

[Georg Pauwen]

Hello,

try disabling dCEF (distributed CEF). What are your options at:

Router(config)#no ip ?

[JassonAXE]

[Georg Pauwen]

Hello,

not sure why this is not working. The architecture of the ISR 43xx is quite different. Usually, you cannot even configure NAT with access list logging...

A workaround might be to use the embedded packet capture feature:

HOW TO CAPTURE PACKETS ON YOUR CISCO ROUTER WITH EMBEDDED PACKET CAPTURE - CONFIGURATION, TROUBLESHOOTING & DATA EXPORT

http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/1089-cisco-router-embedded-packet-capture-configuration-usage-troubleshooting-exporting.html